Systems security researcher formalizing LLM agent safety: verified policies, payment protocols, and rollback controls
3
papers here
1
reviewed by Evolve
0
first-author
0
corresponding
—
works · OpenAlex
—
h-index · OpenAlex
Bibliometric figures come from OpenAlex (2026-10-17) and cover the author's entire public record, not just the papers listed here. Reproducibility signal comes from Evolve's own reviews.
Research profile
Output—
Output metrics are not yet available for this profile. This axis would measure publication volume, venue quality, and productivity over time; current evidence is limited to three 2026 arXiv preprints, so no count or trend can be reported.
Impact—
Impact metrics are not yet available. This axis would measure citations, the citing literature, and real-world uptake of the proposed agent-defense techniques; with only recent preprints in scope, no citation counts or influence estimates are reported.
Focus100/100
The focus score is 100, the maximum, because the field distribution attributes all observed classified activity to a single field: AI security / systems security (LLM agent defense). All three cataloged 2026 papers converge on LLM agent safety, spanning policy-verified runtime enforcement, formal analysis of agent payment protocols, and rollback-based execution control — a deliberately narrow, coherent agenda rather than a scattered portfolio.
Collaboration53/100
The collaboration score is 53, with 13 distinct coauthors recorded. In the frequent-coauthor list, Ke Jiang and Kaiyuan Zhang each appear twice, alongside Jianyu Niu, Guanlong Wu, Dahui Li, Cong Wang, Yuke Peng, Mohan Yu, Yuan Chang, and Mohit Kumar Jangid — a small recurring core group rather than large-scale networking. On the reviewed paper Zhang is last author but not corresponding, consistent with a senior supervisory role.
Activity—
Activity metrics are not yet computed. This axis would measure publication cadence and recent research engagement; the only dated evidence is three papers posted in 2026, which is too short a window to characterize a sustained output rhythm.
Reproducibility55/100
Reproducibility is scored 55, computed as a mean over just one assessed paper (ActGov), whose reproducibility readiness is rated medium. The paper's reliance on LLM-drafted policies checked with the Z3 SMT solver supports artifact-level checking, but Evolve's review notes weak baselines and unverified LLM extraction — so this single-paper score should be read as provisional until more work is assessed.
Research summary
Yinqian Zhang, based at Southern University of Science and Technology, is a systems-security researcher whose current work concentrates on the safety and governance of LLM-driven agents. The Evolve catalog records three 2026 arXiv papers, each with Zhang in the last author position: ActGov, which governs agent actions through policy-constrained validation; A Formal Analysis of Agent Payment Protocols; and Safe to Resume?, which studies breaking agent execution continuity via rollback. In ActGov, the one paper Evolve has reviewed, LLM-drafted policies are checked with the Z3 SMT solver, cutting indirect-prompt-injection attack success to approximately zero on the AgentDojo and AgentDyn benchmarks; the review cautions that weak baselines and unverified LLM extraction temper the formal claims, and rates reproducibility readiness as medium. Bibliometrically the profile is sharply specialized: the field distribution assigns all observed classified activity to AI security / systems security (LLM agent defense), producing a focus score of 100. Collaboration scores 53, with 13 distinct coauthors and recurring partners such as Ke Jiang and Kaiyuan Zhang. Reproducibility is scored 55 from a single assessed paper and should be read as provisional. Output, impact, and activity metrics are not yet available and are deliberately left unscored; the profile is best treated as an early-stage record of a small but thematically coherent agenda.
Collaboration pattern
Bibliometrics record 13 distinct coauthors with a collaboration score of 53. The repeated appearance of Ke Jiang and Kaiyuan Zhang in the frequent-coauthor list points to a stable core team, alongside Jianyu Niu, Guanlong Wu, Dahui Li, Cong Wang, Yuke Peng, Mohan Yu, Yuan Chang, and Mohit Kumar Jangid. Across all three cataloged 2026 papers Zhang takes the last author position without corresponding authorship, consistent with supervising a project group.
Research keywords
Highlights
ActGov drives indirect-prompt-injection attack success to ~0 on AgentDojo and AgentDyn
Formal analysis of agent payment protocols
A second 2026 arXiv paper, A Formal Analysis of Agent Payment Protocols, extends the verification lens to how LLM agents carry out payments. It is cataloged with Zhang in the last author position but has not yet been reviewed by Evolve, so no verdict, keywords, or reproducibility rating is available.
Breaking agent execution continuity via rollback
Safe to Resume? Breaking Execution Continuity of Agent Execution via Rollback examines rollback as an intervention point in LLM agent execution and the safety question of whether resuming is safe. Also a 2026 arXiv preprint with Zhang as last author, it awaits Evolve review.
Timeline
- 2026Publishes ActGov: Governing LLM Agent Actions via Policy-Constrained Validation (arXiv), last-authored; Evolve's review reports indirect-prompt-injection attack success reduced to ~0 on AgentDojo/AgentDyn via LLM-drafted, Z3-verified policies.
- 2026Releases A Formal Analysis of Agent Payment Protocols (arXiv), applying formal analysis to LLM agent payment flows; last-authored and not yet reviewed by Evolve.
- 2026Publishes Safe to Resume? Breaking Execution Continuity of Agent Execution via Rollback (arXiv), examining rollback-based interruption of agent execution; last-authored and awaiting Evolve review.
Papers in the Evolve catalog
Frequent co-authors
About this profile
This profile is AI-structured by Evolve.Pub from public bibliographic data (OpenAlex) and Evolve's own paper reviews. It is not written or endorsed by the researcher unless the profile is claimed. Radar dimensions are computed from real bibliometrics with fixed formulas — raw figures are shown alongside; missing dimensions mean insufficient data, never zero. Errors? Claim the profile to correct or hide it.
- Radar scores are computed from public bibliometric data only; no citation counts, h-index, or venue-quality metrics were included in the input.
- Output, impact, and activity axes have insufficient underlying data and are left unscored rather than estimated.
- The reproducibility score (55) aggregates a single assessed paper (ActGov) and is provisional.
- Profile is name-resolved from public bibliographic data (ORCID 0000-0002-7585-1075); two of the three cataloged papers have not yet been reviewed by Evolve.